Representative image. Eirik Refsdal from Trondheim, NORWAY, CC BY 2.0, Wikimedia Commons
Why it matters
Anyone who owns a vehicle or holds a driving licence has records in these portals. If the data can be bought with just a number plate, strangers can find where owners live and how to reach them, which is why the audit and the app takedowns matter.
After reports that anyone could buy a vehicle owner’s name, address and phone number for a few rupees, the government has turned to its own systems over the vehicle data leak. The Ministry of Road Transport and Highways (MoRTH) has asked CERT-In, the Indian Computer Emergency Response Team that handles cyber security incidents, to carry out a forensic security audit of four portals: VAHAN, SARATHI, e-Challan and PUCC, The Hindu reported on 25 October 2026.
Together these portals hold the transport records of crores of Indians. VAHAN keeps vehicle registrations, SARATHI driving licences, e-Challan traffic fines and PUCC pollution under control certificates.
What the ministry has done so far
According to The Hindu, the ministry has taken four steps:
- Asked CERT-In for a forensic audit of the four portals.
- Written to major app store operators, including Google, asking them to remove apps that sell vehicle owner data.
- Asked the Ministry of Electronics and Information Technology (MeitY) to review its data-sharing policy and suggest how to tighten it.
- In a letter dated 19 October, asked the National Informatics Centre (NIC), the government’s IT arm, to audit who has been using the Unified Logistics Interface Platform (ULIP), a government data platform for logistics firms, and whether they stayed within their approved purpose.
A senior ministry official told The Hindu that a preliminary check found evidence of data misuse involving ULIP, based on unusually high traffic: many entities with access recorded more than 50 lakh hits a month. Officials suspect bad actors were combining data pulled from different portals.
New rules are already in place for some users. Government agencies seeking data now need the Transport Secretary’s approval, and the requesting officer must be verified by an Aadhaar-based digital signature or video KYC (know your customer) check. Officials ruled out stopping data sharing with private companies, saying it supports ease of doing business.
How the VAHAN data reached Telegram and apps
The trigger was a set of findings from researchers. On 1 September 2026 the security firm Cyderes published an investigation into a Telegram-based service that sold a vehicle owner’s full name, father’s name, present and permanent addresses, PIN code and mobile number for ₹5 per registration number. The Hindu reported that the same channel also offered driving licence details, challan history, FASTag information and a downloadable registration certificate.
Cyderes said it did not find that any government database had been hacked. Its report says the seller used real access credentials issued to licensed identity-verification companies, which were being used on systems that had no visible authorisation to hold them. Cyderes said it reported its findings to CERT-In on 1 June 2026, before publishing.
Apps were a second route for vehicle owner data. The Internet Freedom Foundation (IFF), a digital rights group, tested one Play Store app, Vehicle Information App, which showed over 1 crore (10 million) downloads, on a vehicle belonging to a consenting staff member. It paid ₹29 for 15 searches, about ₹1.93 a lookup, and got back data that the official portal hides.
Official portal vs a lookup app: what each shows
| Official Parivahan portal | Vehicle Information App (IFF test) | |
|---|---|---|
| Login needed | Account verified by mobile OTP | None, no OTP sent |
| Owner’s name | Shown masked | Shown in full |
| Father’s name and addresses | Not shown | Shown |
| Financier, insurance policy, chassis and engine numbers | Make, model, insurance and fitness status | Shown |
| Searches allowed | 3 a day under the data-sharing policy | 15 for ₹29 |
The app says everything it shows is public on Parivahan. IFF said that claim is untrue because the Parivahan portal masks the owner’s name and requires a verified login. The other app The Hindu named, VehicleSetu, with over 10 lakh downloads, says it is not linked to the ministry and that its data comes from public sources.
The access is wide. Through a right to information (RTI) request, IFF found that 25,314 credentials had been issued to private entities to use VAHAN, SARATHI, e-Challan and PUCC data, and that they ran 1.708 crore queries over 33 months, The Hindu reported.
Seven years of selling vehicle data: a timeline
This is not the first time the government’s vehicle records have been sold. Using parliamentary replies and documents compiled by IFF, NewsPlainly has put the main dates together:
- March 2019: MoRTH’s Bulk Data Sharing Policy lets a company buy a year’s access to VAHAN and SARATHI for ₹3 crore.
- July 2019: the minister tells the Rajya Sabha the ministry has earned ₹65 crore from 87 private and 32 government entities.
- June 2020: a ministry committee scraps the bulk policy, recording that the data was prone to misuse. The data already sold is not recalled.
- February 2021: a Lok Sabha reply puts total revenue from VAHAN and SARATHI access at about ₹111.39 crore, from more than 170 entities.
- August 2025: a new National Transport Repository policy brings VAHAN, SARATHI, e-Challan, accident reports and FASTag data into one system, covering over 39 crore vehicles and 22 crore driving licences.
- September and October 2026: Cyderes publishes its report, IFF writes to MoRTH, NIC and CERT-In, and the ministry orders the audit.
What the vehicle data leak means for owners
For anyone with a registered vehicle or licence, the practical risk is that a stranger with a number plate can learn where they live and how to call them. In its report, Cyderes said that until one exposure it found is closed, owners should treat any unsolicited call or message that quotes their registration certificate details as a possible sign of this leak. NewsPlainly reported this month on another case where leaked bank customer records raised the risk of scam calls.
IFF has asked MoRTH, NIC and CERT-In to treat the matter as a cyber security incident, preserve logs, trace the data to its source and publish a register of everyone with access to the repository. The ministry has not said when the CERT-In forensic audit into the vehicle data leak will finish or whether its findings will be made public.
Frequently asked questions
Was the VAHAN database hacked?
The security firm Cyderes said it did not find a breach of any government database. It said the seller used real access credentials issued to licensed identity-verification companies.
What details were being sold?
A vehicle owner's full name, father's name, addresses, PIN code and mobile number, and in some cases licence details, challan history and FASTag information, according to Cyderes and The Hindu.
Which portals will CERT-In audit?
VAHAN (vehicle registration), SARATHI (driving licences), e-Challan (traffic fines) and PUCC (pollution certificates), all run by the road transport ministry.